Getting Data In

Monitoring file on unix and alerting based on some condition on the same file

abhijitsaoji
Explorer

I have set file monitoring, file is placed on the Unix . I am able to see the events being indexed in the Splunk however my alerting is not working. on the same file I have set-up some conditional alerting, I want an alert to be raised if particular text appears in the file however it is not triggering.any idea?

0 Karma

skalliger
SplunkTrust
SplunkTrust

To troubleshoot this, we need atleast two things: example data and the SPL (your query) which should fire.

Skalli

0 Karma

abhijitsaoji
Explorer

hey, thanks for the reply. I can't give actual search, but this should do. as

my search in the saved alert:
source="/opt/splunk/akash_test/test" host="XXX" sourcetype="XXX" "test"

as it was not working just to test I was running this above search in my alert. I am editing the file and adding word test in it so that my Alert catches it and send email but its not happening. its a real time search and file is placed on Unix. As i mentioned data is getting indexed in the Splunk I can see it in the Search.

Example data:
test
ABC
test
xxx
test

0 Karma
Get Updates on the Splunk Community!

Routing Data to Different Splunk Indexes in the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...

Getting Started with AIOps: Event Correlation Basics and Alert Storm Detection in ...

Getting Started with AIOps:Event Correlation Basics and Alert Storm Detection in Splunk IT Service ...

Register to Attend BSides SPL 2022 - It's all Happening October 18!

Join like-minded individuals for technical sessions on everything Splunk!  This is a community-led and run ...